Order Information Exposure in WP Helper Premium WordPress Plugin
CVE-2026-18945
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 13 August 2026
Badges
What is CVE-2026-18945?
The WP Helper Premium plugin for WordPress is susceptible to a vulnerability that allows unauthenticated users to access sensitive order details. Specifically, versions prior to 4.7.6 fail to verify order keys when rendering custom order confirmation pages or processing related AJAX actions. This oversight permits unauthorized users to not only view other customers' personal information but also alters the status of arbitrary orders. Notably, the exploitation of this vulnerability necessitates the active use of WooCommerce and the enabling of the plugin's optional order confirmation page module.
Affected Version(s)
WP Helper Premium 0 < 4.7.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.